The data residing on data storage devices, such as hard disk drives and solid state drives, by way of example, is subject to corruption and attack by malicious software (malware). Anti-virus and manageability software packages have been developed by independent software vendors (ISVs) to scan data storage devices to detect corrupted data or malware and/or to provide back-up copies of data. Some storage, security, and manageability ISVs implement services, such as anti-virus scans, removal of malware, system repair, and system reimaging, for example, over the Internet. These Internet-based services still typically rely on local software agents running on the local computing device.
These software solutions, however, are themselves subject to attack by rootkits, spyware, and other types of malware that operate on the premise of hiding themselves from detection. For instance, malware that has disguised itself in the storage stack as a filter driver may be able to provide non-authentic data to the anti-virus or manageability software when a scan of the data storage device is requested (thereby hiding the actual, corrupted data from the software). In other words, the data that is scanned by the anti-virus or manageability software may not be the data that actually resides on the data storage device. Furthermore, once a rootkit is able to hide itself on the platform (e.g., in the master boot record), the rootkit can then observe all user activity, capture user data, perform circumvention of user actions, and other malicious activities. An increasing number of incidents of rootkits, spyware, and other malware have been discovered hiding themselves from users and executing in the background of computing systems, collecting sensitive information and slowing down the systems considerably.